ClawHub
Back to skill

Security audit

Clawnote

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed review-first Xiaohongshu workflow, but it reads broad local records for externally sent drafts and has unsafe persistent memory handling that needs review before use.

Review this skill before installing. Use it only if you are comfortable with the agent reading local sessions, logs, and workspace artifacts and sending draft summaries to the configured Feishu recipient. Validate XHS_REVIEW_OPEN_ID, restrict what local files the workflow may inspect, avoid storing untrusted or multiline memory entries, and patch write_memory_entry.py to validate --date before relying on persistent memory or cron-driven use.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
workspace-template/scripts/write_memory_entry.py:30
Finding

Path Traversal Allows Modification of Persistent Agent Instruction Files

Content
View full analysis
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
workspace-template/scripts/write_memory_entry.py:39
Finding

Untrusted Content Is Persisted and Reloaded as Agent Memory

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
workspace-template/SOUL.md:12
Finding

Broad Local Record Access May Expose Sensitive Information Through Feishu Review

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose presents a narrow, review-first Xiaohongshu workflow, but the detected behavior includes local filesystem writes and generic memory logging not clearly disclosed in the skill contract. This mismatch can mislead operators about what the skill actually does, causing them to authorize execution under false assumptions and increasing the risk of unauthorized data persistence or unintended side effects.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · workspace-template/scripts/publish_approved_note.py (reported line 82)May include surrounding context.

python
root = toolkit_root()
    cmd = build_command(root, payload)
    env = os.environ.copy()
    env["XHS_CHROME_USER_DATA_DIR"] = tempfile.mkdtemp(prefix="xhs-publish-profile-")
    raise SystemExit(subprocess.run(cmd, cwd=root, env=env).returncode)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill declares no explicit tool scope while instructing use of bundled scripts and implying file and shell-capable operations. In an agent environment, missing permission boundaries increases the chance the skill can access environment data, read/write arbitrary files, or invoke commands beyond what users expect from a review-first content workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The default prompt uses a broad invocation phrase that can cause the skill to be triggered in situations beyond the author's intended scope. Because implicit invocation is enabled, ambiguous wording increases the chance of accidental activation for content-generation tasks, which could bypass expected user intent boundaries and start review/publish workflows unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The operational instructions in this file are written entirely in Chinese and implicitly require the agent workflow to operate in that language. There is no indication that users may choose another language or that the locale restriction is intentionally justified as a region-specific skill, which creates a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document provides a concrete deletion command for removing a note by title and timestamp, but it does not require confirmation, preview, or any operator safety checks. In a workflow skill that may be reused operationally, this increases the chance of accidental or socially engineered destructive actions, especially if an agent treats the command examples as approved execution patterns.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Lines L3-L4 are written as prescriptive instructions in Chinese and provide no indication that other languages are allowed. This creates a natural-language locale policy concern because it effectively forces a specific language without user opt-in or a documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The purpose statement is written to operate specifically in Chinese context and references producing a Xiaohongshu publishing package, but it does not offer the user a language or locale choice. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file’s operative instructions are written as mandatory guidance in Chinese for producing Xiaohongshu content, which effectively constrains the skill to a specific language/locale. The policy allows such constraints only when the user is offered a language choice or the locale limitation is clearly documented and justified; neither appears here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · workspace-template/scripts/publish_approved_note.py (reported line 84)May include surrounding context.

python
cmd = build_command(root, payload)
    env = os.environ.copy()
    env["XHS_CHROME_USER_DATA_DIR"] = tempfile.mkdtemp(prefix="xhs-publish-profile-")
    raise SystemExit(subprocess.run(cmd, cwd=root, env=env).returncode)


if __name__ == "__main__":

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
73% confidence
Finding

The documented commands and interaction patterns are entirely in Chinese, which may imply the skill expects or forces a specific language without stating that this is optional or region-specific. The file does not clarify that Chinese is merely an example language or that users may interact in another language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The name 'Xiaohongshu Ops Copilot' hard-codes a specific language/locale/platform context in the skill identity. Because the file does not indicate that this locale is optional, user-selectable, or justified as region-specific, it may conflict with a policy requiring language or locale choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The script writes supplied JSON content into a markdown file under the memory directory and only prints the resulting path afterward. There is no confirmation prompt, warning comment, or docstring explaining that user input will be persisted to disk, which is relevant because the content may include personal notes or preferences.

Content

No source excerpt is available for this finding.